🐧 Updated: the ndaal best-practice auditd rule set for Linux.
Apache-2.0, 1,369 commits, 44 tags since April 2023.
gitlab.com/ndaal_open_s...
#auditd #ndaal #opensource #linux #security

Track unauthorized compute utilization by monitoring binary execution of legacy and rogue miners like `minerd`.

Rules:
-a always,exit -F arch=b64 -F path=/usr/bin/minerd -F perm=x -F key=T1496_Resource_Hijacking

Detect unauthorized ..

#ndaal #auditd #linux #opensource

gitlab.com/ndaal_open_s...

Detect non-system users (`auid>=500`) reading vulnerability data history stored by `debsecan`.

Rules:
-a always,exit -F arch=b64 -F dir=/var/lib/debsecan/ -F perm=r -F auid>=500 -F auid!=-1 -F key=T1005_Data_From_Local_System
#ndaal #auditd #linux

Detect any unauthorized modification, write, or truncation attempts against your core Linux audit system logs.

Rules:
-a always,exit -F arch=b64 -F dir=/var/log/audit/ -F perm=wa -F key=T1685.004_Disable_or_Modify_Tools_Disable_or_Modify_Linux_Audit_System_Log

#ndaal #auditd #linux

🐧 Updated: the ndaal best-practice auditd rule set for Linux.
Apache-2.0, 1,369 commits, 44 tags since April 2023.
gitlab.com/ndaal_open_s...
#auditd #ndaal #opensource #linux #security

🐧 Updated: the ndaal best-practice auditd rule set for Linux.
Apache-2.0, 1,369 commits, 44 tags since April 2023.
gitlab.com/ndaal_open_s...
#auditd #ndaal #opensource #linux #security

🐧 Updated: the ndaal best-practice auditd rule set for Linux.
Apache-2.0, 1,369 commits, 44 tags since April 2023.
gitlab.com/ndaal_open_s...
#auditd #ndaal #opensource #linux #security

Analyze AUDIT_SECCOMP kernel events using auditd and ausearch. Extract syscall numbers, PIDs, and execution paths to investigate process and container kills. #linux #auditd #ausearch

https://www.valtersit.com/vault/extracting-and-analyzing-kernel-seccomp-violations-with-ause-1ba9a6/